hyperframes-motion-graphics

Pass

Audited by Gen Agent Trust Hub on Sep 10, 2026

Risk Level: SAFEINDIRECT_PROMPT_INJECTIONEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDYNAMIC_EXECUTION
Full Analysis
  • [INDIRECT_PROMPT_INJECTION]: The skill processes untrusted data from external sources, which is a common vulnerability surface for indirect prompt injection.
  • Ingestion points: The webpage, news, and tweet categories ingest content from user-provided or search-returned URLs (categories/webpage/module.md, categories/news/module.md, categories/tweet/module.md).
  • Boundary markers: The skill includes some sanitization practices, such as SVG sanitization mentioned in the Figma source instructions and result verification for web captures.
  • Capability inventory: The skill utilizes the hyperframes CLI toolset for composition building and rendering, runs local Node.js scripts for specialized tasks, and invokes ffmpeg for video encoding.
  • Sanitization: No explicit "ignore embedded instructions" wrappers were observed for the ingested textual content.
  • [EXTERNAL_DOWNLOADS]: The skill fetches resources from well-known and trusted services to perform its functions.
  • It downloads MapLibre, TopoJSON, and World Atlas data from the jsdelivr.net CDN for map rendering (categories/maps/bake-basemap.mjs).
  • It incorporates the GSAP animation library from jsdelivr.net in its HTML templates (samples/asset-fusion/_ref-circle-highlight.html).
  • It fetches images and icons from established sources like Wikimedia, Google Images, and the Noun Project during the sourcing phase (phases/source/guide.md).
  • It suggests installing the chrome-headless-shell binary via npx puppeteer for headless browser operations.
  • [COMMAND_EXECUTION]: The skill executes local system commands for media processing and project management.
  • It uses ffmpeg and ffprobe to probe media files, encode video frames, and apply overlays (grounding/locate.mjs, categories/maps/bake-basemap.mjs).
  • It relies on various npx hyperframes commands (init, add, lint, check, snapshot, preview, render) for project orchestration.
  • [DYNAMIC_EXECUTION]: The skill utilizes a headless browser for rendering tasks.
  • The bake-basemap.mjs script launches puppeteer to render geographic basemaps using MapLibre GL JS within a headless Chrome environment.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 10, 2026, 09:49 PM